In this section of the course,
we're going to discuss attack surface determination.
The attack surface determination section
of the course focuses on domain one,
governance, risk and compliance, specifically objective 1.4.
Objective 1.4 states that given a scenario,
you must be able to perform threat modeling activities.
Thoroughly assessing an organization's attack surface
enables the identification of specific vulnerabilities
to protect key assets.
The attack service includes various dimensions
such as the organization's technical infrastructure,
operational processes and cloud-based services.
Each attack surface carries with it distinct risks.
As organizations expand and adapt,
these dimensions can shift,
introducing new vulnerabilities
that require ongoing evaluation and management.
Whether securing established systems
or planning for new deployments,
a detailed approach to attack surface determination
is crucial for proactively mitigating threats.
As we go through this section,
we will cover many topics related
to attack surface determination,
including technical attack surface,
operational attack surface, organizational attack surface,
cloud attack surface, organizational change attack surface,
modeling with an existing system
and modeling without an existing system.
First, we will look at the technical attack surface.
The technical attack surface is the sum
of all potential entry points
within an organization's technology infrastructure
that could be exploited by an attacker.
Technical attack service concepts include
architecture reviews, data flows,
trust boundaries and code reviews.
Architecture reviews involve evaluating the design
and structure of a system to identify weaknesses
or misconfigurations
that could be targeted by a threat actor,
and data flows are examined to understand
how information moves within and between network systems.
Understanding normal data flows enables the assurance
that sensitive data can be adequately protected
and does not cross insecure channels
or inadvertent trust boundaries.
Trust boundaries define the points
where data transitions from one level of trust to another.
Understanding trust boundaries enables the implementation
and management of strict boundary security controls.
Code reviews involve the detailed examination
of source code to detect vulnerabilities.
Code reviews may detect vulnerabilities
such as insecure coding practices,
logic flaws and inserted back doors.
In practice, during an architecture review,
a team might identify that sensitive data
crosses an insecure trust boundary.
This discovery could lead to a code review
that uncovers an insecure data handling function.
This vulnerability can then be corrected
to reduce the technical attack surface.
Next, we will explore the operational attack surface.
The operational service encompasses the vulnerabilities
that arise from day-to-day operations
and human factors within an organization.
Operational attack service concepts include user factors,
the enumeration and discovery of unsanctioned assets,
and the enumeration and discovery of unsanctioned accounts.
User factors involve the potential risks introduced
by users such as weak passwords, phishing susceptibility,
or the misuse of privileges.
The enumeration and discovery of unsanctioned assets
involves identifying unauthorized
or unmanaged devices within the network
that could be exploited by an attacker.
Unauthorized and unmanaged assets
often lack proper security controls
leading to exploitable vulnerabilities.
Similarly,
the enumeration and discovery of unsanctioned accounts
focuses on identifying unauthorized
or orphaned user accounts that could be misused
by malicious actors to gain access to sensitive systems.
For example, during an operational security assessment,
a team might discover several unsanctioned devices
and accounts that were not being monitored.
This would prompt immediate action to secure these devices
and accounts to reduce the operational attack surface.
After that,
we will look at the organizational attack surface.
The organizational attack surface encompasses
the vulnerabilities associated
with an organization's external relationships
and its public-facing digital footprint.
Organizational attack surface concepts include
the enumeration and discovery of third-party connections
and the enumeration and discovery
of an organization's public digital presence.
The enumeration and discovery of third-party connections
involves identifying and assessing all external entities
that have access to the organization's systems or data.
These can include vendors, partners and service providers.
The enumeration and discovery of public digital presence
focuses on mapping the organization's online assets,
including websites, social media accounts,
and publicly accessible systems,
and identified potential exposure points
that could be targeted by an attacker.
For example, during an organizational security review,
a company might discover that an outdated vendor connection
is still active and accessible
along with a neglected public-facing web application,
both of which could be exploited if not secured.
Next, we will explore cloud attack surface.
The cloud attack surface consists of the vulnerabilities
and entry points associated with an organization's internal
and external cloud infrastructure.
Cloud attack surface concepts include the enumeration
and discovery of internally facing assets,
the enumeration and discovery of externally facing assets,
cloud services discovery,
and malicious cloud services and daemons.
The enumeration and discovery of internally facing assets
involves identifying and assessing cloud-based resources
that are accessible only within the organization's network.
These assets include internal databases, virtual machines,
application servers, storage systems,
Application Programming Interface endpoints
and internal communication tools
like messaging services or internet portals.
The enumeration and discovery of externally facing assets
focuses on cloud resources that are publicly accessible.
These assets include web applications,
Application Programming Interfaces, public storage buckets,
Content Delivery Networks, Domain Name Systems servers,
email servers and publicly accessible databases,
or data lakes.
Cloud services discovery involves identifying,
mapping and cataloging all cloud services in use
to identify potential vulnerabilities
or misconfigurations that could be exploited.
Cataloging all cloud services and daemons
may also reveal maliciously installed services in daemon.
Services and daemons are background processes
and programs that run continuously
to manage system function.
Malicious services and daemons can lead
to unauthorized access, persistent back doors,
or the execution of harmful actions within the system,
allowing attackers to maintain control
or disrupt operations without detection.
These malicious services or daemons
might masquerade as legitimate processes,
making them difficult to identify and remove.
Following that,
we will look at the organizational change attack surface.
The organizational change attack surface refers
to vulnerabilities introduced during periods of transition.
Organizational change attack surface concepts include
staffing changes, mergers, acquisitions, and divestitures.
Staffing changes like onboarding or offboarding of employees
can lead to gaps in access control
if accounts are not properly managed.
An example of a staffing change vulnerability is
an orphaned account that could be misused.
Mergers and acquisitions involve the consolidation
of companies or assets through various types
of financial transactions
where one company either merges with or acquires another.
Mergers and acquisitions often involve
integrating disparate systems and networks.
This integration can introduce new vulnerabilities
if security practices are not aligned.
Conversely,
a divestiture is the process of a company selling
or separating a portion of its business,
assets or subsidiaries.
Divestitures may leave sensitive data
or assets insufficiently protected
during the separation process.
For example, during a merger,
an organization might inadvertently grant
excessive access to newly acquired employees,
potentially allowing them to access sensitive systems
or data they should not have,
or an organization might fail to properly secure
or decommission IT resources from a divested business unit,
leaving behind crucial data exposed to unauthorized access.
Then we will explore modeling with an existing system.
Modeling with an existing system evaluates
potential threats and vulnerabilities
specific to the current organizational environment
to determine what can be exploited
and what security controls are necessary to mitigate them.
This process includes identifying threats
that are particularly relevant
to the existing system's architecture and operations.
Based on this assessment,
an organization can select appropriate mitigating controls.
Mitigating controls may include Multi-factor Authentication
to protect against unauthorized access,
deploying encryption to safeguard sensitive data,
or setting up intrusion detection systems
to monitor for suspicious activity.
For example,
if a legacy system is susceptible to SQL injection attacks,
the organization might implement input validation controls
and web application firewalls to prevent exploitation.
Finally,
we will look at modeling without an existing system.
Modeling without an existing system
assesses potential threats and vulnerabilities
for systems that are not yet fully developed or deployed.
Modeling without an existing system is done
to preemptively identify risks
and implement security controls.
This approach requires envisioning
how the system will function,
considering what types of data it will handle,
the expected user interactions
and the anticipated integration points with other systems.
Based on this hypothetical model,
an organization can identify potential threats
such as data breaches or unauthorized access
and then select the appropriate controls such as encryption,
access management and network segmentation
to mitigate these risks
before the system goes into production.
For example,
if an organization is planning to deploy
a new cloud-based customer relationship management system,
they might model potential attack vectors
by analyzing common threats in similar cloud environments.
This could reveal potential vulnerabilities
such as unauthorized access to customer data
or application programming interface abuse.
Based on this analysis,
the organization may decide
to implement multi-factor authentication for all users,
encrypt customer data, both at rest and in transit,
and set strict access controls
for application programming interface endpoints
to prevent abuse.
These proactive measures would help secure
the customer relationship management system
before deployment,
reducing the risk of data breach and unauthorized access.
To finish things off,
we'll take a short quiz to see what you learned
during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into attack surface determination
in this section of the course.